{"id":"MAL-2026-16339","summary":"Malicious code in pf25133 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (504c3f95c937a05e14c220c767a0e18f4cada866ee5eebad0749457232ace73b)\nThe package's declared main module index.js is an IIFE that reads document.cookie, fetches a hardcoded list of application paths, extracts flag-shaped patterns from the responses, and POSTs the aggregated data as JSON to a hardcoded webhook.site collector URL (https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1). The behavior is unconditional on load and the destination is not configurable. webhook.site is a generic anonymous request-bin service unrelated to any legitimate first-party endpoint, and the package ships no functionality other than this collection payload.\n","modified":"2026-09-21T04:00:07.698042723Z","published":"2026-09-21T03:32:43Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020243","import_time":"2026-09-21T03:46:39.253563921Z","modified_time":"2026-09-21T03:32:43Z","sha256":"504c3f95c937a05e14c220c767a0e18f4cada866ee5eebad0749457232ace73b"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pf25133/v/1.0.0"}],"affected":[{"package":{"name":"pf25133","ecosystem":"npm","purl":"pkg:npm/pf25133"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"0d562fbe1e816fb21df7acb49b0f5d293045219699ab0d0afc92e66545e68ae6","tlsh":"99f0dc222e7d102c0a80bacf213bb3b0dc10d815b893cdd483980f3e5b060da58a1294","path":"index.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-XJG0w20lV5ePvlxW+vULkH4I7h8TAIsI57ftq8rei3YIcEYYUu4BUBDjTN3FwktqApPxk2zbbWx6r9UdWC266w==","sha1":"ca711fc5033de59190fb6242e4841c90d30f6c84"},"filename":"pf25133-1.0.0.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pf25133/MAL-2026-16339.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}